summaryrefslogtreecommitdiff
path: root/src/lib/libcrypto/bn
diff options
context:
space:
mode:
authordjm <>2010-03-04 11:02:42 +0000
committerdjm <>2010-03-04 11:02:42 +0000
commitc87e2fef950513f29035f0902cde1cae8fbaf456 (patch)
treef4e593c3e9705b2454c89af66d536e4f5e716173 /src/lib/libcrypto/bn
parenteb98df51d4533bcb55eec48a0547d0a3fd3780bc (diff)
downloadopenbsd-c87e2fef950513f29035f0902cde1cae8fbaf456.tar.gz
openbsd-c87e2fef950513f29035f0902cde1cae8fbaf456.tar.bz2
openbsd-c87e2fef950513f29035f0902cde1cae8fbaf456.zip
cherrypick patch from OpenSSL 0.9.8m:
*) Always check bn_wexpend() return values for failure. (CVE-2009-3245) [Martin Olsson, Neel Mehta]
Diffstat (limited to 'src/lib/libcrypto/bn')
-rw-r--r--src/lib/libcrypto/bn/bn_div.c2
-rw-r--r--src/lib/libcrypto/bn/bn_gf2m.c3
2 files changed, 3 insertions, 2 deletions
diff --git a/src/lib/libcrypto/bn/bn_div.c b/src/lib/libcrypto/bn/bn_div.c
index 1e8e57626b..d6ddc9cbe3 100644
--- a/src/lib/libcrypto/bn/bn_div.c
+++ b/src/lib/libcrypto/bn/bn_div.c
@@ -102,7 +102,7 @@ int BN_div(BIGNUM *dv, BIGNUM *rem, const BIGNUM *m, const BIGNUM *d,
102 /* The next 2 are needed so we can do a dv->d[0]|=1 later 102 /* The next 2 are needed so we can do a dv->d[0]|=1 later
103 * since BN_lshift1 will only work once there is a value :-) */ 103 * since BN_lshift1 will only work once there is a value :-) */
104 BN_zero(dv); 104 BN_zero(dv);
105 bn_wexpand(dv,1); 105 if(bn_wexpand(dv,1) == NULL) goto end;
106 dv->top=1; 106 dv->top=1;
107 107
108 if (!BN_lshift(D,D,nm-nd)) goto end; 108 if (!BN_lshift(D,D,nm-nd)) goto end;
diff --git a/src/lib/libcrypto/bn/bn_gf2m.c b/src/lib/libcrypto/bn/bn_gf2m.c
index 306f029f27..ae642ccb39 100644
--- a/src/lib/libcrypto/bn/bn_gf2m.c
+++ b/src/lib/libcrypto/bn/bn_gf2m.c
@@ -294,7 +294,8 @@ int BN_GF2m_add(BIGNUM *r, const BIGNUM *a, const BIGNUM *b)
294 if (a->top < b->top) { at = b; bt = a; } 294 if (a->top < b->top) { at = b; bt = a; }
295 else { at = a; bt = b; } 295 else { at = a; bt = b; }
296 296
297 bn_wexpand(r, at->top); 297 if(bn_wexpand(r, at->top) == NULL)
298 return 0;
298 299
299 for (i = 0; i < bt->top; i++) 300 for (i = 0; i < bt->top; i++)
300 { 301 {